It probably has been discussed gazillion times, but I what’s the TL;DR? I haven’t heard a good explanation myself
My PERSONAL use case, of why I want VPN->Tor (not vice versa obv otherwise it completely defeats the purpose), is to
Gain more internet privacy/cross-site tracking in light of Palantir, age-vetification, mass surveilance, data capitalism…
And VPN specifically - I just don’t want to SCEAM to my ISP that I’m using Tor.
Yes, if someone is determined enough to actively look into it, Tor connections that originate from VPN servers will definitely stand out and not blend in with the rest of the traffic. But I don’t really care. I’m not doing any crimes so my threat model does not include 3-letter agencies.
But since governments assume that every Tor user must be a criminal, I just do not want to actively broadcast this fact to my ISP, with whom I am KYC’d.
Given all of the above, does this setup seem reasonable, in my case?
Yeah, you can use a VPN and then Tor. You can also directly use Tor. It’s not an illegal software to use so your ISP or your government cannot do anything about it. Assuming you are in a stable Western country and not in places where even VPNs has become or becoming illegal.
Also, these tools are not a silver bullet. If you log into privacy invasive apps/services/etc. then these tools won’t make much difference in your effort to bypass surveillance capitalism. It’s also what you do online that matters too. Not just the tools.
I believe PG still recommends Tor over VPN, though the Tor Project folks would say not to use a VPN
From who? Tor over VPN will indeed permit greater anonymity from the endpoint webserver, by removing your IP as an identifier. You may, however, make your fingerprint more unique to adversaries within the ISP infrastructure: the singular device constantly connected to Mulvad servers is easier to deanonymize across sessions than the device that uses a different Tor Bridge each
This is the strongest reason to use Tor over VPN in my opinion: Tor usage itself can be identifiable, and known Tor users may be scrutinized more
Yes, if someone is determined enough to actively look into it, Tor connections that originate from VPN servers will definitely stand out and not blend in with the rest of the traffic
This would require an advanced adversary, either embedded at the VPN provider, within ISP infrastructure, or compromising the Tor network as a whole. The endpoint webserver will only see a Tor IP, the VPN origin is masked when your traffic passes through Tor